CVE-2017-6066

There are CSRF vulnerabilities in Subrion CMS versions 4.1.x through 4.1.5 and before 4.2.0 due to a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing attacks against the query parameter to the panel/database.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.

Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.

In Subrion CMS version 4.0.5, a vulnerability allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

Path traversal vulnerability in Intelliants Subrion CMS through 4.2.1. Authenticated administrators can delete arbitrary files on the server via the admin panel file deletion endpoint, which passes a user-supplied file path directly to unlink() without sanitization.

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array, which is then placed into %s with only backtick-quoting and no escaping.